Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,033All CVEsplus 19,141 rejected
- 241Last 24 hours3,247 in the last 7 days
- 16,890Last 30 days1,562 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 53 | 93 | 5 | 0 | 153 | 1,607 |
| 2025 | 4 | 12 | 79 | 2 | 0 | 97 | 1,454 |
| 2024 | 2 | 17 | 29 | 1 | 0 | 49 | 1,357 |
| 2023 | 14 | 68 | 154 | 4 | 0 | 240 | 1,308 |
| 2022 | 16 | 82 | 291 | 2 | 0 | 391 | 1,068 |
| 2021 | 12 | 26 | 65 | 0 | 0 | 103 | 677 |
| 2020 | 5 | 50 | 176 | 4 | 0 | 235 | 574 |
| 2019 | 16 | 127 | 192 | 4 | 0 | 339 | 339 |
| Title | ||
|---|---|---|
| CVE-2026-117626 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and…Jenkins Project · Jenkins | Medium4.3 |
| CVE-2026-117625 | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user…Jenkins Project · Jenkins | Medium4.3 |
| CVE-2026-117624 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their…Jenkins Project · Jenkins | High8.8 |
| CVE-2026-117623 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a…Jenkins Project · Jenkins | Medium5.4 |
| CVE-2026-117622 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller,…Jenkins Project · Jenkins | Medium6.1 |
| CVE-2026-117621 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory,…Jenkins Project · Jenkins | Medium6.1 |
| CVE-2026-117620 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can…Jenkins Project · Jenkins | High8.8 |
| CVE-2026-117619 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a…Jenkins Project · Jenkins | High8.1 |
| CVE-2026-117618 | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been…Jenkins Project · Jenkins | High8.1 |
| CVE-2026-117617 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not…Jenkins Project · Jenkins | High8.1 |
| CVE-2026-117616 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with…Jenkins Project · Jenkins | High8.8 |
| CVE-2026-117615 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with…Jenkins Project · Jenkins | Medium6.5 |
| CVE-2026-117614 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent…Jenkins Project · Jenkins | High8.8 |
| CVE-2026-117613 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST…Jenkins Project · Jenkins | Medium5.4 |
| CVE-2026-117612 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during…Jenkins Project · Jenkins | High8.8 |
| CVE-2026-92141 | Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.Jenkins Project · Jenkins Keycloak Authentication Plugin | Medium4.3 |
| CVE-2026-92140 | Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored…Jenkins Project · Jenkins Gitee Plugin | Medium6.8 |
| CVE-2026-92139 | Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured…Jenkins Project · Jenkins Bitbucket Push and Pull Request Plugin | Medium6.5 |
| CVE-2026-92138 | The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather…Jenkins Project · Jenkins Bitbucket Server Integration Plugin | Medium4.2 |
| CVE-2026-92137 | Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the…Jenkins Project · Jenkins Robot Framework Plugin | High8.8 |
| CVE-2026-92136 | Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored…Jenkins Project · Jenkins OWASP Dependency-Check Plugin | High8.0 |
| CVE-2026-92135 | Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API,…Jenkins Project · Jenkins Coverage Plugin | High8.0 |
| CVE-2026-92134 | Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST…Jenkins Project · Jenkins Warnings Plugin | High8.0 |
| CVE-2026-92133 | Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key…Jenkins Project · Jenkins GitLab Plugin | Medium5.4 |
| CVE-2026-92132 | Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity…Jenkins Project · Jenkins Gradle Plugin | Medium5.4 |
| CVE-2026-92131 | Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative…Jenkins Project · Jenkins Pipeline: Groovy Libraries Plugin | Medium4.2 |
| CVE-2026-92130 | Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline…Jenkins Project · Jenkins Pipeline: Multibranch Plugin | Low3.1 |
| CVE-2026-92129 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at…Jenkins Project · Jenkins Script Security Plugin | High7.5 |
| CVE-2026-92128 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and…Jenkins Project · Jenkins Script Security Plugin | High7.5 |
| CVE-2026-92127 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with…Jenkins Project · Jenkins Script Security Plugin | High8.0 |
| CVE-2026-92126 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class,…Jenkins Project · Jenkins Script Security Plugin | High7.2 |
| CVE-2026-92125 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with…Jenkins Project · Jenkins Script Security Plugin | High8.8 |
| CVE-2026-92124 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a…Jenkins Project · Jenkins Script Security Plugin | High8.8 |
| CVE-2026-92123 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and…Jenkins Project · Jenkins Script Security Plugin | High8.8 |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a…Jenkins Project · Jenkins Script Security Plugin | High8.8 |
| CVE-2026-84677 | Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index…Jenkins Project · Jenkins update-center2 | Medium5.4 |
| CVE-2026-84676 | Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be…Jenkins Project · Jenkins Parameterized Remote Trigger Plugin | Medium4.3 |
| CVE-2026-84675 | OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute…Jenkins Project · Jenkins TICS Plugin | High7.4 |
| CVE-2026-84674 | Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of…Jenkins Project · Jenkins XebiaLabs XL Deploy Plugin | Medium5.4 |
| CVE-2026-84673 | Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding,…Jenkins Project · Jenkins Customizable Header Plugin | High8.8 |
| CVE-2026-84672 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID…Jenkins Project · Jenkins Microsoft Entra ID (previously Azure AD) Plugin | High8.8 |
| CVE-2026-84671 | Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler…Jenkins Project · Jenkins File Parameter Plugin | High8.8 |
| CVE-2026-84670 | Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance…Jenkins Project · Jenkins Performance Plugin | High8.8 |
| CVE-2026-84669 | A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report…Jenkins Project · Jenkins Allure Plugin | High8.8 |
| CVE-2026-84668 | Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing…Jenkins Project · Jenkins SAML Plugin | High8.8 |
| CVE-2026-84667 | Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect…Jenkins Project · Jenkins ThinBackup Plugin | High7.1 |
| CVE-2026-84666 | Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data…Jenkins Project · Jenkins Job Configuration History Plugin | Medium5.4 |
| CVE-2026-84665 | Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing…Jenkins Project · Jenkins SonarQube Scanner Plugin | High8.0 |
| CVE-2026-84664 | Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to…Jenkins Project · Jenkins GitLab Plugin | Medium5.4 |
| CVE-2026-84663 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared…Jenkins Project · Jenkins Pipeline: Groovy Libraries Plugin | Medium5.4 |